I found the answer by going through the logs of the loginsight agent (usually in /var/log/loginsight-agent/liagent_<date>):